Your message dated Sun, 21 Apr 2019 15:49:06 +0000
with message-id <[email protected]>
and subject line Bug#924430: fixed in libpodofo 0.9.6+dfsg-5
has caused the Debian Bug report #924430,
regarding libpodofo: CVE-2019-9687
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
924430: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924430
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libpodofo
Version: 0.9.6+dfsg-4
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for libpodofo.
CVE-2019-9687[0]:
| PoDoFo 0.9.6 has a heap-based buffer overflow in
| PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2019-9687
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9687
[1] https://sourceforge.net/p/podofo/code/1969
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libpodofo
Source-Version: 0.9.6+dfsg-5
We believe that the bug you reported is fixed in the latest version of
libpodofo, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Mattia Rizzolo <[email protected]> (supplier of updated libpodofo package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 21 Apr 2019 17:13:10 +0200
Source: libpodofo
Architecture: source
Version: 0.9.6+dfsg-5
Distribution: unstable
Urgency: medium
Maintainer: Mattia Rizzolo <[email protected]>
Changed-By: Mattia Rizzolo <[email protected]>
Closes: 923469 924430
Changes:
libpodofo (0.9.6+dfsg-5) unstable; urgency=medium
.
* Add upstream patches for security issues:
CVE-2019-9199 Closes: #923469
CVE-2019-9687 Closes: #924430
Checksums-Sha1:
02638012f6eb39089205c5ff13cccbb8b8be3670 2182 libpodofo_0.9.6+dfsg-5.dsc
54f683b8bb848bedae913a84a1028dacf33164cc 19692
libpodofo_0.9.6+dfsg-5.debian.tar.xz
1f003342456fef36ec47afd6162f96522dc6beea 8520
libpodofo_0.9.6+dfsg-5_amd64.buildinfo
Checksums-Sha256:
1cb85ff0a5190820ff46e9035f68110a8249c3f8b6b08ac0c3a39b3114f3a029 2182
libpodofo_0.9.6+dfsg-5.dsc
d593b2873535768ffbf75fa8003517e7397581264c560fec6359f3106d93daca 19692
libpodofo_0.9.6+dfsg-5.debian.tar.xz
233718fe7d5755293db4b21fc41db28f48c94e3ee603d08fd9490cf7512f9186 8520
libpodofo_0.9.6+dfsg-5_amd64.buildinfo
Files:
105d1f5ba636e0c71f2752c852d9145d 2182 libdevel optional
libpodofo_0.9.6+dfsg-5.dsc
23a356f738d0f14dd46bd9596fde8c23 19692 libdevel optional
libpodofo_0.9.6+dfsg-5.debian.tar.xz
a70acdb95e1d021015c4f0d5b91b0a00 8520 libdevel optional
libpodofo_0.9.6+dfsg-5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEi3hoeGwz5cZMTQpICBa54Yx2K60FAly8iiAACgkQCBa54Yx2
K604lxAAsXEshnPZwWDlvxiMcQ1hapZMVjSfqkfCdDShO79l6NOhvh3fneoOyntN
Ty8EwY8XolcILZpx3QNmXMftPR0PoFdmmj/oqIZm4+QEC/+rkH/+3ja0SgseEICG
pOdkJdudNCA+yiRg5Ga5wvKmRWCf5Hg/2kasNjAod21pfuMVNv2QhOT8ySC9kowS
xiF+4HDoB4ivcH9qkS6Blwo/fPRGS3/hrGbSLt8QkmFdP7vkddHahxoPeTHMVChr
kSXLmPXus4Zf6pzgh9o5I8HDowYjottPI2Gjw+iobEsq/qej1ut2m0zwUpVLekdp
CWW/NtBMSpjHcrQudFh7x4v6a6Q6WXjpBFvq3Z9yq8v2mSgLGNYx2xYbvdrUl5z+
I0rKC4a5orA3TT4mJTIodjBsZsTsSxhzWHsQfKdktsN+51dlsvZlB9qw0pzcvmF2
IX0/j2uHAKqwqflo94ysGGDdvbKvBpADQSr6rqPL0+YYgbYTm+4T3TWBivH464Ak
xbDDi0ZQhYWKbck4mtsOUs5zFEnmDyVfpVtdFbDHFFvznSBBV7NLB2nHlP/NgEZR
4O3h3h5tAFCy1DEB4Qq0qpDTcskiRHlNK4gkdeqU1GvpD5dA6cYe8M3kVTW3zvbW
h0/EHV/HjNbzqtW/jDca6zBYK93cWVrJG13ZLCyZuthCtmkShZU=
=w6Lm
-----END PGP SIGNATURE-----
--- End Message ---
